CVE-2024-42276 (GCVE-0-2024-42276)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:08 – Updated: 2026-08-05 11:36
VLAI
Title
nvme-pci: add missing condition check for existence of mapped data
Summary
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:11 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4aedb705437f6f98b45f45c394e6803ca67abd33 , < 3f8ec1d6b0ebd8268307d52be8301973fa5a01ec (git)
Affected: 4aedb705437f6f98b45f45c394e6803ca67abd33 , < be23ae63080e0bf9e246ab20207200bca6585eba (git)
Affected: 4aedb705437f6f98b45f45c394e6803ca67abd33 , < 7cc1f4cd90a00b6191cb8cda2d1302fdce59361c (git)
Affected: 4aedb705437f6f98b45f45c394e6803ca67abd33 , < d135c3352f7c947a922da93c8e763ee6bc208b64 (git)
Affected: 4aedb705437f6f98b45f45c394e6803ca67abd33 , < 77848b379e9f85a08048a2c8b3b4a7e8396f5f83 (git)
Affected: 4aedb705437f6f98b45f45c394e6803ca67abd33 , < 70100fe721840bf6d8e5abd25b8bffe4d2e049b7 (git)
Affected: 4aedb705437f6f98b45f45c394e6803ca67abd33 , < c31fad1470389666ac7169fe43aa65bf5b7e2cfd (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.4.282 , ≤ 5.4.* (semver)
Unaffected: 5.10.224 , ≤ 5.10.* (semver)
Unaffected: 5.15.165 , ≤ 5.15.* (semver)
Unaffected: 6.1.103 , ≤ 6.1.* (semver)
Unaffected: 6.6.44 , ≤ 6.6.* (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42276",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:11:52.374763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:31.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:03:15.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:56:44.403Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f8ec1d6b0ebd8268307d52be8301973fa5a01ec",
              "status": "affected",
              "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
              "versionType": "git"
            },
            {
              "lessThan": "be23ae63080e0bf9e246ab20207200bca6585eba",
              "status": "affected",
              "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
              "versionType": "git"
            },
            {
              "lessThan": "7cc1f4cd90a00b6191cb8cda2d1302fdce59361c",
              "status": "affected",
              "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
              "versionType": "git"
            },
            {
              "lessThan": "d135c3352f7c947a922da93c8e763ee6bc208b64",
              "status": "affected",
              "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
              "versionType": "git"
            },
            {
              "lessThan": "77848b379e9f85a08048a2c8b3b4a7e8396f5f83",
              "status": "affected",
              "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
              "versionType": "git"
            },
            {
              "lessThan": "70100fe721840bf6d8e5abd25b8bffe4d2e049b7",
              "status": "affected",
              "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
              "versionType": "git"
            },
            {
              "lessThan": "c31fad1470389666ac7169fe43aa65bf5b7e2cfd",
              "status": "affected",
              "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should have same condition to avoid dereference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the NVMe PCI host driver\u0027s request submission path (`nvme_prep_rq`), reached only by locally submitted block I/O \u2014 ordinary filesystem/direct I/O or `NVME_IOCTL_IO_CMD`/io_uring passthrough on `/dev/nvme0n1`. There is no remote or adjacent-network path to this code.\nAC:L - The error path is entered when the metadata DMA mapping fails, which an attacker can drive by flooding concurrent I/O to exhaust swiotlb bounce-buffer slots or IOVA space (guaranteed bounce-through in confidential-compute guests or DMA-mask-limited setups), and the stale `iod` state is deterministic once the path is taken. No timing race the attacker cannot control is involved.\nPR:L - Only an unprivileged local user with access to an NVMe namespace is required \u2014 normal file I/O on a PI/metadata-formatted namespace sets `REQ_INTEGRITY` with no capability at all, and `nvme_cmd_allowed()` explicitly permits unprivileged passthrough of non-intrusive I/O commands without `CAP_SYS_ADMIN`.\nUI:N - The attacker triggers the condition entirely through its own I/O submissions; no action by another user or administrator is needed.\nS:U - The corruption is confined to kernel memory and DMA mappings managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `nvme_unmap_data()` reads a stale, already-freed `iod-\u003esgt.sgl` scatterlist, and the resulting mempool double-free lets two concurrent requests share one SGL so one request\u0027s data can be steered into another\u0027s buffers; spurious `dma_unmap_page()` of a reassigned IOVA can likewise expose unrelated memory contents to the device.\nI:H - The double `mempool_free()` of the scatterlist is a heap double-free primitive suitable for controlled heap corruption, and tearing down a DMA mapping that has been reallocated leaves the device DMA-writing into memory now owned by other subsystems \u2014 both give arbitrary-write-class integrity impact.\nA:H - The path hits `WARN_ON_ONCE()` and then unmaps DMA using garbage addresses and frees an invalid pointer, producing IOMMU faults, slab/mempool corruption, and kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:17.006Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64"
        },
        {
          "url": "https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83"
        },
        {
          "url": "https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd"
        }
      ],
      "title": "nvme-pci: add missing condition check for existence of mapped data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42276",
    "datePublished": "2024-08-17T09:08:44.694Z",
    "dateReserved": "2024-07-30T07:40:12.261Z",
    "dateUpdated": "2026-08-05T11:36:17.006Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42276",
      "date": "2026-09-20",
      "epss": "0.00246",
      "percentile": "0.16121"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should have same condition to avoid dereference."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nvme-pci: agrega condici\u00f3n faltante para verificar la existencia de datos mapeados. Se llama a nvme_map_data() cuando la solicitud tiene segmentos f\u00edsicos, por lo tanto, nvme_unmap_data() debe tener la misma condici\u00f3n para evitar la desreferencia."
        }
      ],
      "id": "CVE-2024-42276",
      "lastModified": "2024-08-19T12:59:59.177",
      "published": "2024-08-17T09:15:08.673",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3f8ec1d6b0ebd8268307d52be8301973fa5a01ec",
                    "status": "affected",
                    "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "be23ae63080e0bf9e246ab20207200bca6585eba",
                    "status": "affected",
                    "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7cc1f4cd90a00b6191cb8cda2d1302fdce59361c",
                    "status": "affected",
                    "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d135c3352f7c947a922da93c8e763ee6bc208b64",
                    "status": "affected",
                    "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77848b379e9f85a08048a2c8b3b4a7e8396f5f83",
                    "status": "affected",
                    "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "70100fe721840bf6d8e5abd25b8bffe4d2e049b7",
                    "status": "affected",
                    "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c31fad1470389666ac7169fe43aa65bf5b7e2cfd",
                    "status": "affected",
                    "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nvme/host/pci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.282",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.224",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.165",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E51BE530-4BC0-4DAA-B144-7141C5472612",
                    "versionEndExcluding": "5.4.282",
                    "versionStartIncluding": "5.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5CCEDF13-293D-4E64-B501-4409D0365AFE",
                    "versionEndExcluding": "5.10.224",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4E2B568-3171-41DE-B519-F2B1A3600D94",
                    "versionEndExcluding": "5.15.165",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E45EAC72-8329-4F99-8276-86AF9BB3496A",
                    "versionEndExcluding": "6.1.103",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC912330-6B41-4C6B-99AF-F3857FBACB6A",
                    "versionEndExcluding": "6.6.44",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "92D388F2-1EAF-4CFA-AC06-5B26D762EA7D",
                    "versionEndExcluding": "6.10.3",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should have same condition to avoid dereference."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nvme-pci: agrega condici\u00f3n faltante para verificar la existencia de datos mapeados. Se llama a nvme_map_data() cuando la solicitud tiene segmentos f\u00edsicos, por lo tanto, nvme_unmap_data() debe tener la misma condici\u00f3n para evitar la desreferencia."
          }
        ],
        "id": "CVE-2024-42276",
        "lastModified": "2026-08-04T11:19:45.353",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-42276",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:11:52.374763Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-17T09:15:08.673",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:41+00:00",
      "cve": "CVE-2024-42276",
      "id": "CVE-2024-42276",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "70",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nvme-pci: add missing condition check for existence of mapped data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42276.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T02:24:38Z",
      "cve": "CVE-2024-42276",
      "id": "CVE-2024-42276",
      "initial_release_date": "2024-08-18T02:02:46Z",
      "product_status:known_affected": "401",
      "product_status:known_not_affected": "136",
      "product_status:recommended": "643",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42276",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42276.json",
      "version": "105"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:03:15.961Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-42276",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T16:11:52.374763Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:23.844Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/nvme/host/pci.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "3f8ec1d6b0ebd8268307d52be8301973fa5a01ec",
                  "status": "affected",
                  "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                  "versionType": "git"
                },
                {
                  "lessThan": "be23ae63080e0bf9e246ab20207200bca6585eba",
                  "status": "affected",
                  "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                  "versionType": "git"
                },
                {
                  "lessThan": "7cc1f4cd90a00b6191cb8cda2d1302fdce59361c",
                  "status": "affected",
                  "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                  "versionType": "git"
                },
                {
                  "lessThan": "d135c3352f7c947a922da93c8e763ee6bc208b64",
                  "status": "affected",
                  "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                  "versionType": "git"
                },
                {
                  "lessThan": "77848b379e9f85a08048a2c8b3b4a7e8396f5f83",
                  "status": "affected",
                  "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                  "versionType": "git"
                },
                {
                  "lessThan": "70100fe721840bf6d8e5abd25b8bffe4d2e049b7",
                  "status": "affected",
                  "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                  "versionType": "git"
                },
                {
                  "lessThan": "c31fad1470389666ac7169fe43aa65bf5b7e2cfd",
                  "status": "affected",
                  "version": "4aedb705437f6f98b45f45c394e6803ca67abd33",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/nvme/host/pci.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.2"
                },
                {
                  "lessThan": "5.2",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.282",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.224",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.165",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.103",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.44",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.282",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.224",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.165",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.103",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.44",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.3",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: add missing condition check for existence of mapped data\n\nnvme_map_data() is called when request has physical segments, hence\nthe nvme_unmap_data() should have same condition to avoid dereference."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T09:25:44.237Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec"
            },
            {
              "url": "https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba"
            },
            {
              "url": "https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c"
            },
            {
              "url": "https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64"
            },
            {
              "url": "https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83"
            },
            {
              "url": "https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7"
            },
            {
              "url": "https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd"
            }
          ],
          "title": "nvme-pci: add missing condition check for existence of mapped data",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-42276",
        "datePublished": "2024-08-17T09:08:44.694Z",
        "dateReserved": "2024-07-30T07:40:12.261Z",
        "dateUpdated": "2025-11-03T22:03:15.961Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.